The vulnerability arises from improper authorization, allowing privileged users to view the first 40 characters of post edits in private messages and private categories. This exposes previously hidden content to users who should not have access, potentially revealing sensitive or confidential information. The weakness is a classic example of lack of proper access control errors.

The affected product is Discourse, the open‑source discussion platform. Versions prior to 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are vulnerable. The patch was included in those releases and later ones. Updating to at least 2026.3.0‑latest.1 resolves the issue.

The CVSS score of 2.2 indicates a low severity impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. It is inferred that an attacker would need only to interact with private categories or private messages and could expose edit details simply by accessing the platform, making exploitation straightforward but unlikely to be actively targeted.